Matt Malone is the Samuelson-Glushko Assistant Professor of Law at the University of Ottawa.
Since its launch in 2017, TikTok has become one of Canada’s most popular apps – and the source of many privacy and security concerns. Roughly 14 million Canadians use the app, with about 40 per cent of Canadians aged 16 to 29 checking it daily. As today’s report from various Canadian privacy regulators recognizes, many Canadians even younger than that are using it, too.
Despite its importance in so many Canadians’ lives, Ottawa’s current TikTok policy is a mess. On the one hand, the government has used the Investment Canada Act to shut down TikTok Technology Canada Inc. – the domestic subsidiary responsible for selling ads and engaging in lobbying – on the basis of a confidential review.
On the other hand, the government has let TikTok Pte. Ltd. – the Singapore-based company that distributes the app in Canada through the Google Play Store and Apple App Store – to operate without major restriction. Canadians can still download and use TikTok, and TikTok Pte. Ltd. can still collect, use and disclose their data.
This oddly bifurcated approach shows a lack of sophistication in addressing Canadians’ actual concerns with the app, which are largely the same set of concerns that motivated Ottawa to ban the app on its government-issued devices back in February, 2023.
First, TikTok’s addictive algorithm is indisputably influencing beliefs, values and behaviour, especially among young people. While much of this influence is benign, the Hogue Inquiry underscored how malicious actors also utilize vectors such as TikTok to stoke social divisions. Canadians want to understand if and how that is happening.
TikTok made ‘inadequate’ efforts to protect children, federal investigation finds
Second, TikTok’s collection of data is largely unchecked, leaving many Canadians’ personal information vulnerable in the hands of certain foreign actors. Canadian TikTok user data are not stored in Canada; instead, they are on servers in the United States, Singapore and Malaysia. As Canadian Security Intelligence Service director Dan Rogers told Parliament in December, it is “certainly foreseeable” that China has access to these data.
In addition to China, many Canadians will be concerned about storage of their data in the U.S. under American surveillance laws such as Section 702 of the Foreign Intelligence Surveillance Act, which permits warrantless collection of communications of foreigners located abroad when their data are stored on American soil.
Finally, TikTok’s control over the information environment continues to pose critical questions about trust and polarization. TikTok is the least trusted social-media platform in Canada. The app’s role in potentially destabilizing our democratic institutions is in question, too. During the last federal election, a deepfake of Prime Minister Mark Carney announcing a ban on cars made before 2000 that originated on TikTok circulated widely.
Sadly, Canada’s current policy approach addresses none of these issues. By banning the corporate entity while leaving the app basically unregulated, the government has constrained investigative capacity, pushed accountability abroad and weakened public trust.
The government’s secretive approach has led many Canadians to wonder why the corporate entity is dangerous enough to be kicked out of the country, while the app remains apparently safe enough for Canadian youth to use.
Why TikTok is being sold to American owners
Canada needs a new approach. First, to understand what is happening on TikTok, government and trusted researchers should be allowed to study it. To do so, they must be given real-time access to data. Canada needs to take seriously the restrictions on such access that providers such as Meta Platforms Inc., X and TikTok have imposed in recent years – and reverse those restrictions with mandated access requirements.
Second, during the Investment Canada Act review, TikTok Technology Canada Inc. offered access to the app’s source code, but Ottawa apparently declined. That was a mistake. Canada should mandate source-code access for government auditors and trusted researchers.
Finally, Canadians overwhelmingly oppose having their personal information stored abroad, especially when it is accessible to a state that our own signals intelligence agency calls “the most sophisticated and active cyber threat to Canada.” The U.S. and the European Union already require data localization of their citizens’ TikTok user data. Canada should follow suit.
Of course, these TikTok-specific measures should not distract Canada from the urgent task of modernizing its outdated privacy and data-protection regime. We need to raise thresholds for data collection, enhance protections for minors and appoint serious regulators. Waiting 31 months for our regulators to decide whether TikTok obtains valid and meaningful consent from kids is simply unacceptable.
Canada is now in an era in which foreign actors are deeply empowered to manipulate our citizens’ online lives in troubling ways. But we have little in the way of law or regulation to show we understand this new paradigm. While it seems clear TikTok will remain a part of Canadians’ digital lives for the foreseeable future, the question is whether Canada will watch as a spectator or regulate as a sovereign.